I was wondering how I could override dynamic library calls in Linux, and I came across this technique known as function interposition. It is a powerful technique that allows you to override dynamic library calls. It might sound dull, but it can be very, very useful. There are some memory trace tools that make use of this technique to work, but perhaps a cooler example is the OpenGL capture system which was created by nullkey: it can capture OpenGL frames by overriding certain OpenGL functions. Another example are cheat tools (wallhacks, aimbots) which also make use of this technique a lot.

Some background

While Googling (did I spell that right?) I came across this recent blog article which explains the background very well. I will quote it here:

First, some background. When a program that uses dynamic libraries is compiled, a list of undefined symbols is included in the binary, along with a list of libraries the program is linked with. There is no correspondence between the symbols and the libraries; the two lists just tell the loader which libraries to load and which symbols need to be resolved. At runtime, each symbol is resolved using the first library that provides it. This means that if we can get a library containing our wrapper functions to load before other libraries, the undefined symbols in the program will be resolved to our wrappers instead of the real functions.

So if we create a custom shared library which overrides some of the functions of the original library, our functions will be called instead of those of the original library.

How to do it

• Write new functions which override existing functions
• Compile the written code to a dynamic library that is linked to the dynamic linking interface library
• Use the LD_PRELOAD environment variable when running an application to preload your custom library before all other dynamic libraries

The article by Jay Conrod has an example which shows you the basic implementation of a simple memory allocation tracer.

I have also cooked up an example myself. Because I’ve been busy learning more about OpenGL, I thought that it shouldn’t be too hard to create a wallhack for one of my favourite games: Soldier of Fortune 2 running in Wine. Just for testing purposes of course! I am no cheater It turned out to be relatively simple, although my first tries weren’t so very successful:

• Epic fail – At least I know my library is used now.
• Partial success – Disabling depth testing completely was only a partial success.
• Success – A debugger can tell that players are drawn using glDrawElements(). By knowing the number of elements for each character, we can disable depth testing selectively.

Soldier of Fortune 2 wallhack example

For those of you who are interested in the code:

Interesting thought about multiplayer cheats and Wine

If anti-cheat tools would perform a sanity check of the OpenGL or DirectX DLL, they would only find the virtual DLL’s when a game is run in Wine, right? I’m wondering whether this sort of cheats can be made undetectable then. In a way I hope not, because cheaters are very annoying when you’re playing a game, but on the other hand, it would be an amazing technological achievement. Anyway, anti-cheat tools like PunkBuster don’t even work with Wine at the moment, so it might be a non-issue. What are your thoughts?

Fourth chapter: fog, fonts revisited, quadrics, particle engine, triangle strips, masking

In the fourth chapter you will learn a few cooler tricks. You will learn how to create good-looking fog effects and how certain objects can easily be constructed using quadrics. But the coolest thing that you will learn is how to create a simple particle engine (during lesson 19). To end off the chapter, you will learn how you can use masking to create partial transparency using bitmap textures.

Some minor modifications were made to improve the visual appearance of some of the lessons.

Videos and source code

This video shows the fog effect (lesson 16)
This video shows what you can achieve using quadrics (lesson 18)
This video shows the very cool particle engine that you will create! (lesson 19)
This video shows which effect masking has (lesson 20)
You can download the Qt 4 source code for this chapter here.

PS: The port of chapter 5 will take a while… I will be a bit busy the coming weeks, and the first lesson of chapter 5 is HUGE, so will require a lot of time to port.
Oh, and apparently I forgot to upload the source code for the third chapter. I have uploaded it now

Third chapter: waving texture, display lists and a lot of fonts

The third chapter starts off with a cool looking waving flag effect. After that you will learn about display lists. The last three lessons focus on different ways of displaying fonts. It is worth noting that rendering basic text at a chosen location, or translated into the OpenGL scene is extremely easy in Qt/OpenGL thanks to QGLWidget::renderText(). For other basic text effects (such as rotated, skewed or otherwise transformed text) you could also use QPainter directly on a QGLWidget. We won’t be doing this in our examples, but I just wanted to point out that it is possible.

I should also note that I have used an extra library in lesson 14 to display the 3D text. Qt itself is not able to display 3D text and doing this in a cross-platform way yourself would be rather hard. That’s why I have used the FTGL library for this. FTGL is a very easy to use cross-platform library with the sole purpose of rendering (3D) text in OpenGL.

Videos and source code

This video shows the waving flag effect (lesson 11)
This video shows the effect of using display lists (lesson 12)
This video shows rotated 3D text (lesson 14)
You can download the Qt 4 source code for this chapter here.

PS: You can expect chapter 4 in a few days

First chapter: setting up an OpenGL window, polygons, colors, rotation, 3D shapes

After completing the first chapter, you will end up with a rotating pyramid and cube…

This video shows the end result (lesson 5).
You can download the Qt 4 source code for this chapter here.

Second chapter: texture mapping, texture filters, lighting, keyboard control, blending, moving bitmaps in 3D space, loading and moving through a 3D world

In the second chapter you will learn a lot about textures, among some other things. Sometimes we make use of QGLContext::bindTexture() to load an image, morph it into a texture and bind it to OpenGL all in one go. Other times we will do it manually because we want to specify the texture filter ourselves (but we do have QGLWidget::convertToGLFormat() which makes that easy as well). To handle keypresses we simply reimplement keyPressEvent(). To load in the 3D world from the file we make use of the excellent QFile and QTextStream classes. As an added bonus, we also make use of QGLWidget::renderText() to show the user what has changed when a key is pressed inside the OpenGL window. Lesson 9 also features a bonus fade-in effect for the revived stars. This makes the effect look much cooler.

This video shows the result of adding texture filters, lighting and keyboard control (lesson 7)
This video shows the result of all the above plus blending (lesson 8)
This video shows the result of moving bitmaps in 3D space (lesson 9)
This video shows the result of moving through a very simple 3D world (lesson 10)
You can download the Qt 4 source code for this chapter here.

The third and fourth chapter are almost complete as well, but I will give you the Qt ports of those chapters another time. Perhaps tomorrow.

That was my motivation for trying to do a few things with the Netwide Assembler (NASM). The result is a simple demo which utilizes libc, GLUT and OpenGL to display a rotating pyramid and cube.

compiled ogl.asm application running in Ubuntu 8.04

The resulting code can be viewed here:

I have also written two other smaller examples:
- marketing.asm is a really simple statistics application which calculates the ideal sample size given a few parameters
- alsawav.asm is a simple audio library which utilizes ALSA to play an unbuffered raw WAV/PCM sample

Please note that all these examples require an x86 Linux distribution. These examples will not work on any other operating system.